feat: unify settings (#3128)

packages/trpc/server/envelope-router/sign-envelope-field.ts

@@ -4,6 +4,7 @@ import { validateFieldAuth } from '@documenso/lib/server-only/document/validate-
 import { DOCUMENT_AUDIT_LOG_TYPE } from '@documenso/lib/types/document-audit-logs';
 import { createDocumentAuditLogData } from '@documenso/lib/utils/document-audit-logs';
 import { extractFieldInsertionValues } from '@documenso/lib/utils/envelope-signing';
+import { assertRecipientNotExpired } from '@documenso/lib/utils/recipients';
 import { prisma } from '@documenso/prisma';
 import { DocumentStatus, FieldType, RecipientRole, SigningStatus } from '@prisma/client';
 import { match } from 'ts-pattern';
@@ -108,6 +109,12 @@ export const signEnvelopeFieldRoute = procedure
       });
     }
 
+    // Both are checked because an assistant may insert values into a field belonging to
+    // another recipient, and neither signing window may have closed. For every other
+    // role these reference the same recipient.
+    assertRecipientNotExpired(recipient);
+    assertRecipientNotExpired(field.recipient);
+
     if (recipient.signingStatus === SigningStatus.SIGNED || field.recipient.signingStatus === SigningStatus.SIGNED) {
       throw new AppError(AppErrorCode.INVALID_REQUEST, {
         message: `Recipient ${recipient.id} has already signed`,